chore(secrets): wire cache invalidation on rotate/delete, drop dead RevealEnabled, remove scaffold leftovers

2026-07-15 17:39:55 -04:00
parent 294f53b49a
commit e20812cbae
10 changed files with 74 additions and 29 deletions
@@ -163,6 +163,23 @@ public class DefaultSecretResolverTests
        Assert.Equal(2, store.GetCount);
    }

+    [Fact]
+    public async Task Invalidate_ViaCacheInvalidatorSeam_ForcesReload()
+    {
+        var (resolver, store, _, cipher, _) = NewSut();
+        var name = new SecretName("sql/foo");
+        store.Seed(MakeRow(cipher, name, "hunter2"));
+
+        // Exercise the SAME seam the write path (Ui rotate/delete) uses: ISecretCacheInvalidator.
+        ISecretCacheInvalidator invalidator = resolver;
+
+        await resolver.GetAsync(name, CancellationToken.None); // caches (count 1)
+        invalidator.Invalidate(name);
+        await resolver.GetAsync(name, CancellationToken.None); // cache evicted → hits the store again
+
+        Assert.Equal(2, store.GetCount);
+    }
+
    [Fact]
    public async Task Get_DefaultActorIsSystem_WhenNoAccessor()
    {
@@ -57,6 +57,33 @@ public sealed class AddZbSecretsTests
        }
    }

+    [Fact]
+    public void CacheInvalidator_And_Resolver_AreSameSingletonInstance()
+    {
+        string dbPath = NewTempDbPath();
+        string envVar = $"ZB_TEST_KEY_{Guid.NewGuid():N}";
+        Environment.SetEnvironmentVariable(envVar, Base64Key32());
+        try
+        {
+            var services = new ServiceCollection();
+            services.AddZbSecrets(BuildConfig(dbPath, envVar), "Secrets");
+            using ServiceProvider provider = services.BuildServiceProvider();
+
+            var resolver = provider.GetService<ISecretResolver>();
+            var invalidator = provider.GetService<ISecretCacheInvalidator>();
+
+            Assert.NotNull(resolver);
+            Assert.NotNull(invalidator);
+            // Same object: an invalidation MUST hit the exact cache the resolver reads from.
+            Assert.Same(resolver, invalidator);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(envVar, null);
+            File.Delete(dbPath);
+        }
+    }
+
    [Fact]
    public async Task Resolver_Works_EndToEnd_ThroughDi()
    {
@@ -1,7 +0,0 @@
-namespace ZB.MOM.WW.Secrets.Tests;
-
-public class PlaceholderTests
-{
-    [Fact]
-    public void Builds() => Assert.True(true);
-}